CISO responsibility for operational technology cyber security 2022-2024

According to a 2023 survey, a consequence of the continued vulnerability of operational technology (OT) networks to cyberattacks is the increased involvement of Chief Information Security Officers (CISOs) in OT cyber security decision-making. This trend was confirmed by 95 percent of respondents in 2023, up from 88 percent in 2022.

An ever-increasing number of attacks

Recent years have witnessed a surge in the number and scale of cyberattacks targeting OT systems, used to monitor, control, and automate physical processes, devices, and infrastructure in crucial, asset-intensive industries, including power grids, transportation and telecommunications systems, and healthcare facilities. The digital transformation experienced in our societies has resulted in the growing connectedness of OT environments, expanding OT owners’ attack surface, but also in growing IT-OT convergence.

Insiders represent the biggest threat

Considering the importance of industrial process continuity and public safety-related impacts, it comes as no surprise that both organized crime and state-sponsored actors see critical infrastructure (CI) as lucrative targets for financial gain, espionage, or cyberwarfare operations. Nevertheless, well-meaning but negligent insiders are considered the biggest threat actors to OT security, with malicious insiders ranking second. When attempting to reduce the attack surface, CI organizations face diverse obstacles, from operational requirements to lack of personnel, depending on their responsibility level.